Security Advisories
Published OpenWISP security advisories and historical security fixes are listed below, most recent first. Follow the links for details and upgrade guidance.
2026-10-15, OpenWISP RADIUS (GHSA-83gw-w3g2-6658): CSV batch imports can attach and delete users from other organizations.
2026-10-15, OpenWISP Controller (GHSA-4f2x-pxjx-h8m3): Stored XSS in template names can execute in administrator sessions.
2026-10-15, OpenWISP Controller (GHSA-39c4-xj33-j8j3): Device-location updates can access and transfer locations across organizations.
2026-09-15, OpenWISP RADIUS (GHSA-pfx3-4m53-g475): SMS verification bypasses destination and IP restrictions.
2026-06-15, OpenWISP IPAM (GHSA-x287-5c68-36wp): Broken object-level authorization allows exporting another organization's subnet and IP addresses.
2024-08-20, OpenWISP WiFi Login Pages: Replaced the compromised polyfill.io script source to prevent malicious JavaScript delivery.
2022-06-28, OpenWISP Users 1.0.2: Updated django-allauth to fix social-account linking CSRF and password-reset rate-limit bypasses.
2021-07-01, Ansible OpenWISP and Docker OpenWISP: Fixed nginx alias path traversal exposing files outside the static and media directories.
2021-04-09, OpenWISP Controller: Fixed internal HTTP endpoints exposing other organizations' UUIDs and sensitive information.
Announcements are also sent to the OpenWISP mailing list. To report a new suspected vulnerability privately, follow the instructions in Disclosing Vulnerabilities.